{"id":"https://openalex.org/W2131041885","doi":"https://doi.org/10.1109/nas.2007.20","title":"Discovering Novel Multistage Attack Patterns in Alert Streams","display_name":"Discovering Novel Multistage Attack Patterns in Alert Streams","publication_year":2007,"publication_date":"2007-07-01","ids":{"openalex":"https://openalex.org/W2131041885","doi":"https://doi.org/10.1109/nas.2007.20","mag":"2131041885"},"language":"en","primary_location":{"id":"doi:10.1109/nas.2007.20","is_oa":false,"landing_page_url":"https://doi.org/10.1109/nas.2007.20","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2007 International Conference on Networking, Architecture, and Storage (NAS 2007)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5036723430","display_name":"Zhang Ai-fang","orcid":null},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ai-fang Zhang","raw_affiliation_strings":["Huazhong University of Science and Technology, China","Huazhong University of Science and Technology, WuHan#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Huazhong University of Science and Technology, China","institution_ids":["https://openalex.org/I47720641"]},{"raw_affiliation_string":"Huazhong University of Science and Technology, WuHan#TAB#","institution_ids":["https://openalex.org/I47720641"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111575598","display_name":"Zhitang Li","orcid":"https://orcid.org/0000-0003-2818-3139"},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhi-tang Li","raw_affiliation_strings":["Huazhong University of Science and Technology, China","Huazhong University of Science and Technology, WuHan#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Huazhong University of Science and Technology, China","institution_ids":["https://openalex.org/I47720641"]},{"raw_affiliation_string":"Huazhong University of Science and Technology, WuHan#TAB#","institution_ids":["https://openalex.org/I47720641"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100407387","display_name":"Dong Li","orcid":"https://orcid.org/0000-0001-9336-0694"},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dong Li","raw_affiliation_strings":["Huazhong University of Science and Technology, China","Huazhong University of Science and Technology, WuHan#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Huazhong University of Science and Technology, China","institution_ids":["https://openalex.org/I47720641"]},{"raw_affiliation_string":"Huazhong University of Science and Technology, WuHan#TAB#","institution_ids":["https://openalex.org/I47720641"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100336135","display_name":"Li Wang","orcid":"https://orcid.org/0000-0002-9615-1879"},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Li Wang","raw_affiliation_strings":["Huazhong University of Science and Technology, China","Huazhong University of Science and Technology, WuHan#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Huazhong University of Science and Technology, China","institution_ids":["https://openalex.org/I47720641"]},{"raw_affiliation_string":"Huazhong University of Science and Technology, WuHan#TAB#","institution_ids":["https://openalex.org/I47720641"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I47720641"],"apc_list":null,"apc_paid":null,"fwci":0.4734,"has_fulltext":false,"cited_by_count":17,"citation_normalized_percentile":{"value":0.58869427,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":96},"biblio":{"volume":"3","issue":null,"first_page":"115","last_page":"121"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.996399998664856,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9957000017166138,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.851586639881134},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.6343415975570679},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.6326922178268433},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5430170893669128},{"id":"https://openalex.org/keywords/construct","display_name":"Construct (python library)","score":0.53521728515625},{"id":"https://openalex.org/keywords/attack-patterns","display_name":"Attack patterns","score":0.5305870771408081},{"id":"https://openalex.org/keywords/volume","display_name":"Volume (thermodynamics)","score":0.458700567483902},{"id":"https://openalex.org/keywords/network-administrator","display_name":"Network administrator","score":0.4564436078071594},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.45548903942108154},{"id":"https://openalex.org/keywords/data-stream-mining","display_name":"Data stream mining","score":0.4313663840293884},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.41527116298675537},{"id":"https://openalex.org/keywords/attack-model","display_name":"Attack model","score":0.4113115072250366},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.3091241121292114},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.16001448035240173}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.851586639881134},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6343415975570679},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.6326922178268433},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5430170893669128},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.53521728515625},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.5305870771408081},{"id":"https://openalex.org/C20556612","wikidata":"https://www.wikidata.org/wiki/Q4469374","display_name":"Volume (thermodynamics)","level":2,"score":0.458700567483902},{"id":"https://openalex.org/C2779173999","wikidata":"https://www.wikidata.org/wiki/Q680296","display_name":"Network administrator","level":2,"score":0.4564436078071594},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.45548903942108154},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.4313663840293884},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.41527116298675537},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.4113115072250366},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3091241121292114},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.16001448035240173},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/nas.2007.20","is_oa":false,"landing_page_url":"https://doi.org/10.1109/nas.2007.20","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2007 International Conference on Networking, Architecture, and Storage (NAS 2007)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":27,"referenced_works":["https://openalex.org/W20722260","https://openalex.org/W69141675","https://openalex.org/W109441098","https://openalex.org/W1501543699","https://openalex.org/W1536395052","https://openalex.org/W1549767874","https://openalex.org/W1582506709","https://openalex.org/W1641039719","https://openalex.org/W1837847590","https://openalex.org/W2039902065","https://openalex.org/W2109662977","https://openalex.org/W2115149820","https://openalex.org/W2136561182","https://openalex.org/W2141200504","https://openalex.org/W2158454296","https://openalex.org/W2161932631","https://openalex.org/W2163277533","https://openalex.org/W3094284177","https://openalex.org/W4231518042","https://openalex.org/W6600858539","https://openalex.org/W6602815637","https://openalex.org/W6604511647","https://openalex.org/W6632020558","https://openalex.org/W6636681434","https://openalex.org/W6683534485","https://openalex.org/W6784272883","https://openalex.org/W6806824271"],"related_works":["https://openalex.org/W2997026285","https://openalex.org/W1567294858","https://openalex.org/W2361755837","https://openalex.org/W2566384264","https://openalex.org/W2537496145","https://openalex.org/W2357769287","https://openalex.org/W2765141658","https://openalex.org/W4248653431","https://openalex.org/W3027216454","https://openalex.org/W2108770704"],"abstract_inverted_index":{"With":[0],"the":[1,8,19,43,48,73,106,135,143,150,174,177],"growing":[2],"deployment":[3],"of":[4,11,52,111,171,176],"network":[5,127],"security":[6],"devices,":[7],"large":[9],"volume":[10],"alerts":[12],"gathered":[13],"from":[14],"these":[15],"devices":[16],"often":[17],"overwhelm":[18],"administrator,":[20],"and":[21,46,79,100,114],"make":[22,70],"it":[23,64],"almost":[24],"impossible":[25],"to":[26,36,41,69,81,93,141,161],"discover":[27,96,162],"complicated":[28],"multistage":[29,54],"attacks":[30,45],"in":[31,56,117,179],"time.":[32],"It":[33,103],"is":[34,65,76,91],"necessary":[35],"develop":[37],"a":[38,53,66,86,125,138,154],"real-time":[39],"system":[40],"detect":[42,142],"ongoing":[44],"predict":[47],"upcoming":[49],"next":[50],"step":[51],"attack":[55,61,97,131,145,164],"alert":[57],"streams,":[58],"using":[59,120,157],"known":[60],"patterns.":[62,146],"So":[63],"key":[67],"mission":[68],"sure":[71],"that":[72,166],"pattern":[74],"definition":[75],"correct,":[77],"complete":[78],"up":[80],"date.":[82],"In":[83],"this":[84,180],"paper,":[85],"classical":[87],"data":[88],"mining":[89,159],"algorithm":[90,160],"used":[92],"help":[94],"us":[95],"patterns,":[98],"construct":[99],"maintain":[101],"rules.":[102],"can":[104,148],"overcome":[105],"highly":[107],"dependent":[108],"on":[109],"knowledge":[110],"experts,":[112],"time-consuming":[113],"error-prone":[115],"drawbacks":[116],"previous":[118],"approaches":[119],"manual":[121],"analysis.":[122],"Unfortunately,":[123],"for":[124],"dynamic":[126],"environment":[128],"where":[129],"novel":[130,144,155],"strategies":[132],"appear":[133,167],"continuously,":[134],"method":[136],"shows":[137],"limited":[139],"capability":[140],"We":[147],"address":[149],"problem":[151],"by":[152],"presenting":[153],"approach":[156],"incremental":[158],"new":[163],"patterns":[165],"recently.":[168],"A":[169],"series":[170],"experiments":[172],"show":[173],"validity":[175],"methods":[178],"paper.":[181]},"counts_by_year":[{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":1},{"year":2018,"cited_by_count":2},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":2},{"year":2014,"cited_by_count":1},{"year":2013,"cited_by_count":1},{"year":2012,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}